Description
A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-09
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the geminithinking component of bartekke8it56w2 new-mcp 0.1.0 and allows local attackers to manipulate the sessionPath argument used by the fs.readFileSync function in index.ts. This manipulation results in path traversal, enabling the attacker to read arbitrary files the process can access. The weakness is classified as CWE‑22 and does not grant remote code execution but can expose sensitive data stored locally.

Affected Systems

bartekke8it56w2 new-mcp version 0.1.0 is affected. No other versions are listed in the current data.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate complexity and impact. EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog, implying no publicly known exploits. Since the attack requires local access, risk is limited to environments where the application runs with elevated privileges or where the local user has legitimate access rights. An attacker could read configuration files, credentials, or other sensitive data present on the host by providing a crafted sessionPath value.

Generated by OpenCVE AI on August 9, 2026 at 23:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Contact the project maintainer and request a fixed version or a temporary patch.
  • Wrap the geminithinking usage in a validator that rejects paths containing '..' or absolute paths, preventing traversal.
  • Limit the file system permissions of the process, so that even if a traversal occurs, only non‑sensitive files can be accessed.

Generated by OpenCVE AI on August 9, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 09 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.
Title bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversal
First Time appeared Bartekke8it56w2
Bartekke8it56w2 new-mcp
Weaknesses CWE-22
CPEs cpe:2.3:a:bartekke8it56w2:new-mcp:*:*:*:*:*:*:*:*
Vendors & Products Bartekke8it56w2
Bartekke8it56w2 new-mcp
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Bartekke8it56w2 New-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-09T22:00:10.073Z

Reserved: 2026-08-09T07:06:00.299Z

Link: CVE-2026-19370

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T00:00:07Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')